EP3151148B1 - System und verfahren zur erzeugung von sets von antivirusaufzeichnungen zur detektion von malware auf benutzervorrichtungen - Google Patents

System und verfahren zur erzeugung von sets von antivirusaufzeichnungen zur detektion von malware auf benutzervorrichtungen Download PDF

Info

Publication number
EP3151148B1
EP3151148B1 EP16158363.8A EP16158363A EP3151148B1 EP 3151148 B1 EP3151148 B1 EP 3151148B1 EP 16158363 A EP16158363 A EP 16158363A EP 3151148 B1 EP3151148 B1 EP 3151148B1
Authority
EP
European Patent Office
Prior art keywords
file
antivirus
malicious
files
record
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP16158363.8A
Other languages
English (en)
French (fr)
Other versions
EP3151148A1 (de
Inventor
Sergey V. Prokudin
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Kaspersky Lab AO
Original Assignee
Kaspersky Lab AO
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from RU2015141552A external-priority patent/RU2617654C2/ru
Application filed by Kaspersky Lab AO filed Critical Kaspersky Lab AO
Publication of EP3151148A1 publication Critical patent/EP3151148A1/de
Application granted granted Critical
Publication of EP3151148B1 publication Critical patent/EP3151148B1/de
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements

Definitions

  • the present invention relates generally to the field of computer security and, more specifically to systems and methods of generating a set of antivirus records to be used for detection of malicious files on a user's computing devices.
  • the antivirus software may use a number of different methods of detecting malicious software, malicious processes, other malicious objects of the operating system (OS) and links to them, such as the URI (Universal Resource Identifier, such as file://***.exe ).
  • the most popular malware detection methods are signature analysis (a technology for finding correspondences between a particular segment of code of the program being analyzed and a known code, or signature, in a database of signatures of malicious programs), heuristic analysis (a technology involving emulating the working of a program being analyzed, creating an API (Application Programming Interface) function call log, and finding correspondences between the data of the created API function call log and the data in a database of emulations of malicious programs), and proactive analysis (a technology involving intercepting API function calls launched in the system of the program being analyzed, creating an API function call log, and finding correspondences between the data of the created log and the data in a database of calls for API functions of malicious programs).
  • signature analysis a technology for finding correspondences between a particular segment of code of
  • each of the aforementioned methods requires data to be used for the detection of malicious objects, for example, in the case of signature analysis, such data might be signatures, for heuristic analysis, such the data might be heuristic rules.
  • the antivirus software may detect a whole array of malicious objects similar in their structure or in the harm caused. Therefore, the ever increasing number of malicious objects which can cause harm to the user's data or to his computer requires a corresponding increase in the volume of data used for detecting malicious objects.
  • said data is stored on the user's computer as part of antivirus libraries - a component of the antivirus software.
  • increasing the volume of data used for the detection may result in the decrease of available space on the hard drive of the user device.
  • Document EP 2 854 065 A1 refers to a system and a method for evaluating malware detection rules for effectiveness and accuracy.
  • the detection rule defines criteria for distinguishing files having a characteristic of interest from other files lacking that characteristic, for instance, malicious files vs. benign files.
  • the detection rule is applied to a set of unknown files. This produces a result set that contains files detected from among the set of unknown files as having the at least one characteristic of interest.
  • Each file from the result set is compared to at least one file from a set of known files having the characteristic to produce a first measure of similarity, and to at least one file from a set of known files lacking the characteristic to produce a second measure of similarity.
  • the detection rule In response to the first measure of similarity exceeding a first similarity threshold, the detection rule is deemed effective.
  • the detection rule is deemed inaccurate.
  • a device may comprise a protection module to identify threats to at least one of the device or to a network including the device.
  • the protection module may include, for example, a rule evaluator (RE) module to evaluate proposed security rules for identifying the threats based on at least one ground truth scenario and to determine whether to promote the proposed security rules to new security rules.
  • the proposed security rules may be generated by the protection module or received from other devices in the network or other networks. New security rules may be shared with the other devices and/or networks.
  • the RE module may further trigger an independent evaluation of the proposed security rules, which may also be considered when determining whether to add the proposed security rules to the set of active rules in the device.
  • the invention is defined by the scope of the appended claims.
  • Example aspects of the present invention are described herein in the context of a system, method, and computer program product for generating a set of antivirus records to be used for detection of malicious files on a user's computing devices.
  • Those of ordinary skill in the art will realize that the following description is illustrative only and is not intended to be in any way limiting. Other aspects will readily suggest themselves to those skilled in the art having the benefit of this disclosure.
  • a malicious application may include an application able to cause harm to a computer or to the data of the computer user, for example, an Internet worm, a key logger, a computer virus.
  • the harm caused may be unlawful access to computer resources, including the data being stored on the computer, for the purpose of theft, and also unlawful use of resources, including for data storage, performance of calculations, and so on.
  • a trusted application may include an application which does not cause harm to the computer or its user.
  • a trusted application can be an application developed by a trusted software manufacturer, downloaded from a trusted source (such as a site listed in a database of trusted sites) or an application whose identifier (such as the MD5 of the application file) is stored in a database of trusted applications.
  • the manufacturer's identifier such as a digital certificate, may also be stored in the database of trusted applications.
  • An untrusted application may include an application which is not trusted, but also not recognized as being malicious, for example, by means of an antivirus application.
  • a malicious file may include a component of a malicious application, such as an executable file, a configuration file, and other files used by the application during its execution.
  • An untrusted file may include a file which is a component of an untrusted application.
  • a trusted file may include a file which is a component of a trusted application.
  • Signature analysis may include a technology of finding correspondences between a particular segment of program code and a known code - signature - from a database of signatures of malicious programs with the goal of detecting a malicious program. It should be noted that this technology can be used both to detect files of a malicious program and to detect malicious code in the RAM of a computing device.
  • Heuristic analysis may include a technology involving emulating the execution of a program (executing program code, adapted for execution with the use of certain hardware and software, by making use of other hardware and software different from the former), creating an API function call log, and finding correspondences between the data of the created API function call log and the data from a database of emulations of malicious programs in order to detect a malicious program.
  • Proactive analysis may include a technology involving intercepting API function calls launched in the operating system of the program, creating an API function call log, and finding correspondences between the data from the created log and the data from a database of API function calls of malicious programs in order to detect a malicious program.
  • An antivirus record may include information needed by the antivirus application to detect malicious files. It may be, for example, a signature, a heuristic rule (which can be used, for example, by heuristic and proactive analysis), a check sum or hash of a file (including a flexible or locality-sensitive hash - a file hash which is invariant to minor file changes).
  • the statistics on the use of an antivirus record may include information on the number of malicious files detected by the antivirus application using the antivirus record, and also an identifier of each file detected with the help of the antivirus record (for example, a check sum calculated according to one of the algorithms: MD5, SHA-1, SHA-2, or a character string - the file name).
  • the collection of statistics may be done by the antivirus application using the antivirus record for detection of malicious files (during the detection of malicious files).
  • the effectiveness of an antivirus record may be a numerical value; the larger it is, the more malicious files have been detected by the antivirus application using that antivirus record among the files in a files database.
  • Fig. 1 shows a diagram of an exemplary system for generating a set of antivirus records to be used for detection of malicious files on a user's computer according to one aspect of the invention.
  • an antivirus application 101 which is configured to detect malicious files on the computer 100.
  • the antivirus application 101 uses the antivirus records stored in a database of antivirus records 102, which likewise may reside on the user's computer 100.
  • the user's computer 100 is connected via a network 110 (for example, the Internet or a local area network, LAN) to a remote server 120.
  • the remote server 120 may be a single computing device.
  • the remote server 120 may be a set of connected computing devices performing distributed computations (computations in which the overall volume of computations, such as the execution of code, is broken up into parts and distributed among several computing devices) for performing functions of systems and methods disclosed herein.
  • the remote server 120 may include an antivirus application 121, a module of creating antivirus records 125, a module of generating sets of antivirus records 126, a module of evaluation of the effectiveness of antivirus records 127, a database of antivirus records 122, a database of files 123 and a database of statistics 124.
  • the antivirus application 101 and the antivirus application 121 in one example of the invention may perform similar functions in the detection of malicious objects and collection statistics, which will be described below.
  • the database of files 123 is configured to store files, such as malicious files, trusted files and untrusted files, as well as information as to whether a file being stored is malicious, trusted, or untrusted.
  • files are added to the database of files 123 by an expert in computer security together with information (indication) as to whether the file is malicious, trusted, or untrusted.
  • file identifiers may be stored in the database of files 123 (for example, check sums of files calculated according to one of the algorithms: MD5, SHA-1, SHA-2, or a character string - the file name).
  • the antivirus application 121 is configured to detect malicious files. For detection of malicious files, the antivirus application 121 utilizes antivirus records (at least one) from a database of antivirus records 122, the database of antivirus records 122 being configured to store antivirus records. The antivirus records may be used by the antivirus application 121 in the course of performing a signature, heuristic or proactive analysis.
  • the antivirus record may contain a flexible hash (locality-sensitive hash).
  • the flexible hash is also known as a "flexible convolution" constitutes a hash sum (hash) which is calculated from a set of file attributes, which is resistant to slight changes in the file (for example, the hash sum calculated from the file will coincide with the hash sum calculated from a file in which one of the attributes, for example, has a different value).
  • the antivirus application 121 during the analysis of the file in order to detect a malicious file will calculate the flexible hash of the file being analyzed (from the set of file attributes) and compare this with the flexible hash from the antivirus record.
  • the antivirus record may contain, besides a flexible hash, information (such as a character identifier) as to the method of calculating the hash, which needs to be used by the antivirus application 121 during the analysis of the file. It should be noted that the above-described method of detection (using antivirus records containing a flexible hash) of malicious files can also be used by the antivirus application 101 which is residing on the user's computer 100.
  • the module for creating antivirus records 125 is configured to create antivirus records and store them in a database of antivirus records 122.
  • the module 125 uses the file (which will need to be detected with the help of the antivirus record) and one of the following methods of creating antivirus records.
  • the module for creating antivirus records 125 creates an antivirus record for detection of a malicious file, said record containing a signature (a sequence of bytes of the file) of the indicated file so that the file is recognized as malicious by the antivirus application 121 if it contains the signature from the antivirus record.
  • a signature a sequence of bytes of the file
  • the module for creating antivirus records 125 creates an antivirus record for detection of a malicious file, said record containing a heuristic rule such that said file is recognized as malicious by the antivirus application 121 in accordance with the logic of the heuristic rule, which is applied to the API function call log which is generated during the emulated execution of the program (if the file is executable) during the heuristic analysis of the file.
  • the technology described in a commonly owned US Patent 9,147,073 may be used to create such an antivirus record.
  • the module for creating antivirus records 125 creates an antivirus record for detection of a malicious file, said record containing a heuristic rule such that said file is recognized as malicious by the antivirus application 121 in accordance with the logic of the heuristic rule, which is applied to the API function call log which is generated upon interception of API function calls which is launched in the operating system of the program (if the file is executable) during the proactive analysis of the file.
  • a heuristic rule such that said file is recognized as malicious by the antivirus application 121 in accordance with the logic of the heuristic rule, which is applied to the API function call log which is generated upon interception of API function calls which is launched in the operating system of the program (if the file is executable) during the proactive analysis of the file.
  • the module for creating antivirus records 125 creates an antivirus record for detection of a malicious file, said record containing a flexible hash of the file, such that said file is recognized as malicious by the antivirus application 121 if the calculated flexible hash of the file matches up with the flexible hash from the antivirus record.
  • the module for creating antivirus records 125 is configured to create several antivirus records for the same malicious file, by means of which records said file can be recognized as malicious by the antivirus application 121 (for example, with the use of several of the aforementioned methods of creating an antivirus record).
  • the module of creating antivirus records 125 is able to create antivirus records containing different flexible hashes for detection of one and the same file (we shall assume that such antivirus records are created using different methods for creation of antivirus records). Each of these antivirus records is created with the use of its own method of calculation of the hash (for example, one of the methods listed below).
  • the module of creating antivirus records 125 may use algorithm for calculation of flexible hashes for creating antivirus records as described in a commonly owned US Patent 8,955,120 .
  • the sets of file attributes used in calculating the flexible hash may be different:
  • the following set of file attributes may be used: the file size, the file image size, the number of file sections, the RVA (Related Virtual Address) of the file sections, the RVA of the entry point, the type of subsystem, the file characteristics from the COFF (Common Object File Format) header, the mutual arrangement of the objects of the table of directories, the disposition of the objects of the table of directories by file sections, the type of compiler used to create the file, the frequency characteristics of the characters (including printed characters) - the frequencies of encountering the characters in the file, the set of lines of the file and their number.
  • a set of file attributes for each file section includes the following attributes: the informational entropy of the beginning and end of a section, the average number of nonzero bytes of the beginning and end of a section, the virtual size of a section, the physical size of a section.
  • the following set of file attributes may be used: the file size, the file image size, the number of file sections, the RVA of the file sections, the RVA of the entry point, the type of subsystem, the file characteristics from the COFF header, the type of compiler used to create the file;
  • the following set of file attributes may be used: the file size, the file image size, the type of subsystem, the frequency characteristics of the characters (the frequencies of encountering the characters in the file, the set of lines of the file and their number).
  • the following set of file attributes may be used: the file size, the file image size, the number of file sections, file sections, the RVA of the entry point, the type of subsystem, the file characteristics from the COFF header, the mutual arrangement of the objects of the table of directories, the disposition of the objects of the table of directories among the file sections, the type of compiler used to create the file, the frequency characteristics of the characters.
  • the set of file attributes for each file section may include the following attributes: the informational entropy of the beginning and end of a section, the average number of nonzero bytes of the beginning and end of a section, the virtual size of a section, the physical size of a section.
  • the following set of file attributes may be used: the file size, the file image size, the type of subsystem, the file characteristics from the COFF header, the type of compiler used to create the file, the frequency characteristics of the characters.
  • the module for creating antivirus records 125 allows an expert in computer security to create an antivirus record (e.g., via a user's interface) for one of the aforementioned methods of detection (e.g., signature, heuristic analysis, and others).
  • an expert in computer security to create an antivirus record (e.g., via a user's interface) for one of the aforementioned methods of detection (e.g., signature, heuristic analysis, and others).
  • the module for creating antivirus records 125 stores the created antivirus records in the database of antivirus records 122.
  • the module for creating antivirus records 125 uses malicious files from the database of files 123 for one or more creating antivirus records using one or more of the aforementioned methods, respectively, with the help of which the antivirus application 121 can recognize as malicious the aforesaid files from the database of files 123.
  • the antivirus application 121 is configured to collect statistics on the use of antivirus records to be used for detection of malicious files.
  • the statistics on the use of antivirus records is collected using the database of files 123, as well as the database of antivirus records 122, specifically upon detection of malicious files with the use of the antivirus records from the database of antivirus records 122 among the files of the database of files 123.
  • the antivirus application 121 sends statistics collected on the use of the antivirus records for storage to the database of statistics 124. It should be noted that the antivirus application 121, using an antivirus record, can recognize as malicious not only known malicious files (such as malicious files from the database of files 123 ), but also trusted files (whose detection is considered a "false alarm” or "false positive”) or untrusted files from the database of files 123.
  • the database of statistics 124 is configured to save the statistics on the use of antivirus records collected by the antivirus application 121.
  • the module of evaluating the effectiveness of antivirus records 127 is configured to determine (calculate) the effectiveness of at least one antivirus record.
  • the module 127 calculates the effectiveness of each antivirus record from the database of antivirus records 122 for which the antivirus application 121 has collected statistics on the use of antivirus record and saved this statistics on the use of antivirus record in the database of statistics 124.
  • K the effectiveness of the antivirus record
  • U is the number of files (in one example, from the database of files 123 ) which have been recognized as malicious by the antivirus application 121 using the aforementioned antivirus record
  • f is a coefficient which takes on the value 0 if there are trusted files among the files which have been recognized as malicious by the antivirus application 121 using the aforementioned antivirus record, and otherwise the value 1.
  • K the effectiveness of the antivirus record
  • n the total number of files which have been recognized as malicious using said antivirus record
  • a i is a coefficient which can take on, for example, the following values (for the i-th file):
  • Information as to whether a file is malicious, trusted or untrusted, which is used in the above formula, can be obtained from the database of files 122 using the file identifier from the statistics on the use of antivirus record.
  • the database of files 122 in addition to each file can store its weighting factor p - popularity (number of users on whose computers such a file is found).
  • this weighting factor for each file can be added to the database of files 122 by an expert in computer security.
  • Information as to whether a file is malicious, trusted or untrusted, which is used in the above formula, and also the coefficient p i for each file, can be obtained from the database of files 122 by the file identifier from the statistics on the use of antivirus record.
  • the module for generating a set of antivirus records 126 is configured to generate a set of antivirus records for transmission of said set of antivirus records to the user's computer 100, specifically to the database of antivirus records 102.
  • the module 126 may utilize antivirus records from the database of antivirus records 122, as well as the effectiveness of each aforementioned antivirus record, provided by the module 127 from the database of antivirus records 122.
  • the purpose of generating a set of antivirus records is to generate a set of antivirus records so that all malicious files from the database of files 123 can be detected with the help of the antivirus application 121 utilizing the aforementioned set of antivirus records.
  • This set of antivirus records consists of a minimum quantity of antivirus records, which reduces the amount of memory on the hard drive of the user's computer 100 occupied by the antivirus records stored in the database of antivirus records 102 and used by the antivirus application 101.
  • the module for generating a set of antivirus records 126 may generate a set of antivirus records as follows: for a malicious file from the database of files 123 an antivirus record is selected with the highest effectiveness from among those antivirus records in the database of antivirus records 122. Using these records the antivirus application 121 recognized said file as being malicious (in accordance with the statistics on the use of antivirus records previously collected by the antivirus application 121 ). The selected record is added to the set of antivirus records by the module for generating a set of antivirus records 126. For the next file from the database of files 123 in similar fashion an antivirus record is selected with the highest effectiveness from among those antivirus records of the database of antivirus records 122.
  • the antivirus application 121 recognized the mentioned file as being malicious, while if the selected antivirus record is already present in the set of antivirus records being generated by the module 126, the antivirus record will not be added once more (to exclude duplication of antivirus records in the set). But if the selected antivirus record is not present in the set of antivirus records, the mentioned antivirus record is added by the module 126 to the set of antivirus records.
  • the module for generating a set of antivirus records 126 performs the aforementioned actions for each malicious file from the database of files 123.
  • the set of antivirus records generated in this way is sent by the module 126 to the user's computer 100, specifically to the database of antivirus records 102, for subsequent use of the antivirus records from the transmitted set of antivirus records by the antivirus program 101 for detection of malicious files on the user's computer 100.
  • Fig. 2 shows an exemplary method of generating a set of antivirus records to be used for detection of malicious files on a user's computer according to one aspect of the invention.
  • the module of creating antivirus records 125 creates a set of antivirus records for each malicious file from the database of files 123, each of the antivirus records from the set may be created using one of the above-described methods of creating antivirus records.
  • the created antivirus records are saved by the module 125 in the database of antivirus records 122.
  • the antivirus application 121 collects statistics on the use of the antivirus records from the database of antivirus records 122.
  • Te antivirus application 121 uses the antivirus records from the database of antivirus records 122 to detect malicious files among the files (all files, not only the malicious ones) from the database of files 123 (the detection of a malicious file by the antivirus application 121 meaning the recognition of the file as being malicious in accordance with the antivirus records used by the antivirus application 121 ).
  • the collected statistics on the use of the antivirus records are saved by the antivirus application 121 in the database of statistics 124.
  • the module for evaluating the effectiveness of antivirus records 127 calculates the effectiveness of each antivirus record from the database of antivirus records 122 on the basis of the statistics on the use of the antivirus records, which are contained in the database of statistics 124.
  • each antivirus record is sent by the module 127 to the module of generating a set of antivirus records 126.
  • the module 126 generates a set of antivirus records, such that for each malicious file from the database of files 123, the antivirus record is selected with the highest effectiveness from among all the antivirus records. Using this record the antivirus application 121 recognized that file as being malicious. The selected antivirus records is added by the module for generating a set of antivirus records 126 to the aforementioned set of antivirus records (being generated).
  • the information as to which files are recognized as malicious by the antivirus application 121 using the antivirus record, which information is needed by the module of generating a set of antivirus records 126 to generate the set of antivirus records, is stored in the database of statistics 124 - the database of statistics saves for each antivirus record the identifiers of each file recognized as malicious by the antivirus application 121 with the use of said antivirus record.
  • the module of generating a set of antivirus records 126 determines all the antivirus records from the database of antivirus records 122, using which the antivirus application 121 recognized this file as being malicious.
  • the generated set of antivirus records in step 205 is sent by the module of generating a set of antivirus records 126 to the database of antivirus records 102 residing on the user's computer 100, for later use of the antivirus records from this set by the antivirus application 101 to detect malicious files on the user's computer 100.
  • Fig. 3 illustrates an example of a general-purpose computer system (which may be a personal computer or a server) on which the disclosed systems and method can be implemented.
  • the computer system includes a central processing unit 21, a system memory 22 and a system bus 23 connecting the various system components, including the memory associated with the central processing unit 21.
  • the system bus 23 is realized like any bus structure known from the prior art, containing in turn a bus memory or bus memory controller, a peripheral bus and a local bus, which is able to interact with any other bus architecture.
  • the system memory includes permanent memory (ROM) 24 and random-access memory (RAM) 25.
  • the basic input/output system (BIOS) 26 includes the basic procedures ensuring the transfer of information between elements of the personal computer 20, such as those at the time of loading the operating system with the use of the ROM 24.
  • the personal computer 20 includes a hard disk 27 for reading and writing of data, a magnetic disk drive 28 for reading and writing on removable magnetic disks 29 and an optical drive 30 for reading and writing on removable optical disks 31, such as CD-ROM, DVD-ROM and other optical information media.
  • the hard disk 27, the magnetic disk drive 28, and the optical drive 30 are connected to the system bus 23 across the hard disk interface 32, the magnetic disk interface 33 and the optical drive interface 34, respectively.
  • the drives and the corresponding computer information media are effectiveness-independent modules for storage of computer instructions, data structures, program modules and other data of the personal computer 20.
  • the present disclosure provides the implementation of a system that uses a hard disk 27, a removable magnetic disk 29 and a removable optical disk 31, but it should be understood that it is possible to employ other types of computer information media 56 which are able to store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random-access memory (RAM) and so on), which are connected to the system bus 23 via the controller 55.
  • solid state drives, flash memory cards, digital disks, random-access memory (RAM) and so on which are connected to the system bus 23 via the controller 55.
  • the computer 20 has a file system 36, where the recorded operating system 35 is stored, and also additional program applications 37, other program modules 38 and program data 39.
  • the user is able to enter commands and information into the personal computer 20 by using input devices (keyboard 40, mouse 42).
  • Other input devices can be used: microphone, joystick, game controller, scanner, and so on.
  • Such input devices usually plug into the computer system 20 through a serial port 46, which in turn is connected to the system bus, but they can be connected in other ways, for example, with the aid of a parallel port, a game port or a universal serial bus (USB).
  • a monitor 47 or other type of display device is also connected to the system bus 23 across an interface, such as a video adapter 48.
  • the personal computer can be equipped with other peripheral output devices (not shown), such as loudspeakers, a printer, and so on.
  • the personal computer 20 is able to operate in a network environment, using a network connection to one or more remote computers 49.
  • the remote computer (or computers) 49 are also personal computers or servers having the majority or all of the aforementioned elements in describing the nature of a personal computer 20.
  • Other devices can also be present in the computer network, such as routers, network stations, peer devices or other network nodes.
  • Network connections can form a local-area computer network (LAN) 50 and a wide-area computer network (WAN). Such networks are used in corporate computer networks and internal company networks, and they generally have access to the Internet.
  • LAN or WAN networks the personal computer 20 is connected to the local-area network 50 across a network adapter or network interface 51.
  • the personal computer 20 can employ a modem 54 or other modules for providing communications with a wide-area computer network such as the Internet.
  • the modem 54 which is an internal or external device, is connected to the system bus 23 by a serial port 46. It should be noted that the network connections are only examples and need not depict the exact configuration of the network, i.e., in reality there are other ways of establishing a connection of one computer to another by technical communication modules.
  • the systems and methods described herein may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the methods may be stored as one or more instructions or code on a non-transitory computer-readable medium.
  • Computer-readable medium includes data storage.
  • such computer-readable medium can comprise RAM, ROM, EEPROM, CD-ROM, Flash memory or other types of electric, magnetic, or optical storage medium, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a processor of a general purpose computer.
  • module refers to a real-world device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or field-programmable gate array (FPGA), for example, or as a combination of hardware and software, such as by a microprocessor system and a set of instructions to implement the module's functionality, which (while being executed) transform the microprocessor system into a special-purpose device.
  • a module can also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software.
  • a module can be executed on the processor of a general purpose computer (such as the one described in greater detail in Fig. 3 above). Accordingly, each module can be realized in a variety of suitable configurations, and should not be limited to any particular implementation exemplified herein.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Information Transfer Between Computers (AREA)
  • Debugging And Monitoring (AREA)

Claims (15)

  1. Verfahren zum Erzeugen eines Satzes von Antivirus-Aufzeichnungen, wobei das Verfahren umfasst:
    Aufrechterhalten, durch einen Server (120), einer Datenbank (123) von Dateien, wobei die Datenbank (123) von Dateien dazu konfiguriert ist, schädliche Dateien, vertrauenswürdige Dateien und nicht vertrauenswürdige Dateien zu speichern;
    Erzeugen, durch den Server (120), mehrerer Antivirus-Aufzeichnungen, die unterschiedliche lokalitätssensitive Hashes für jede schädliche Datei enthalten, in der Datenbank (123) von Dateien, wobei jede der mehreren Antivirus-Aufzeichnungen einen lokalitätssensitiven Hash umfasst, der aus einem unterschiedlichen Satz von Dateiattributen der schädlichen Datei berechnet wurde;
    Berechnen, durch den Server (120), einer Effektivität jeder Antivirus-Aufzeichnung durch Bestimmen, wie viele unterschiedliche schädliche Dateien unter Verwendung jeder Antivirus-Aufzeichnung detektiert wurden, und einer Anzahl von falschen positiven Detektionen durch die Antivirus-Aufzeichnung;
    Erzeugen, durch den Server (120), eines Satzes von effektivsten Antivirus-Aufzeichnungen, umfassend:
    Auswählen, für jede bekannte schädliche Datei, der effektivsten Antivirus-Aufzeichnung, die bei einer Detektion der schädlichen Datei verwendet wurde, wobei die effektivste Antivirus-Aufzeichnung als eine Funktion sowohl der Anzahl unterschiedlicher schädlicher Dateien, die durch die Antivirus-Aufzeichnung detektiert wurden, als auch der Anzahl falscher positiver Detektionen durch die Antivirus-Aufzeichnung berechnet wird;
    Bestimmen, ob die ausgewählte Antivirus-Aufzeichnung bereits im Satz enthalten ist; und
    ansprechend auf ein Bestimmen, dass die ausgewählte Antivirus-Aufzeichnung nicht im Satz enthalten ist, Hinzufügen der Aufzeichnung zu dem Satz; und
    Übertragen, durch den Server (120), des Satzes von effektivsten Antivirus-Aufzeichnungen an ein Kundengerät (100).
  2. Verfahren nach Anspruch 1, wobei jede Antivirus-Aufzeichnung ferner eine oder mehrere umfasst von: einer Signatur einer schädlichen Datei; einer heuristischen Regel, die zur Detektion einer schädlichen Datei während einer Emulation der schädlichen Datei verwendet wurde; oder einer heuristischen Regel, die zur Detektion einer schädlichen Datei während einer proaktiven Detektion verwendet wurde.
  3. Verfahren nach Anspruch 1 oder 2, wobei das Berechnen einer Effektivität jeder Antivirus-Aufzeichnung ein Sammeln, durch eine Antivirus-Anwendung (121), die auf dem Server (120) läuft, von Statistiken über eine Anzahl von schädlichen Dateien umfasst, die durch die Antivirus-Anwendung (121) unter Verwendung jeder Antivirus-Aufzeichnung detektiert wurden.
  4. Verfahren nach Anspruch 1 oder 2, wobei die Effektivität einer Antivirus-Aufzeichnung als eine Funktion einer Anzahl von unterschiedlichen schädlichen Dateien, die durch die Antivirus-Aufzeichnung detektiert wurden, der Anzahl von falschen positiven Detektionen durch die Antivirus-Aufzeichnung und einer Kategorie berechnet wird, zu der jede der detektierten schädlichen Dateien gehört, wobei die Kategorie vertrauenswürdig, nicht vertrauenswürdigen oder schädlich umfasst.
  5. Verfahren nach Anspruch 4, wobei die Effektivität einer Antivirus-Aufzeichnung ferner als eine Funktion einer Popularität jeder detektierten schädlichen Datei auf Kundengeräten (100) berechnet wird.
  6. Verfahren nach Anspruch 1 oder 2, wobei der Satz von Dateiattributen der schädlichen Datei, der verwendet wird, um wenigstens einen der lokalitätssensitiven Hashes zu berechnen, umfasst:
    a) die Dateigröße, die Dateibildgröße, die Anzahl von Dateisektionen, die zugehörige virtuelle Adresse (Related Virtual Address; RVA) der Dateisektionen, die RVA des Eintrittspunkts, den Typ Subsystem, die Dateicharakteristika aus dem Header des allgemeinen Objektdateiformats (Common-Object-File-Format; COFF), und den Typ Compiler, der verwendet wurde, um die Datei zu erzeugen;
    b) die Dateigröße, die Dateibildgröße, den Typ Subsystem, und die Frequenzcharakteristika der Zeichen in der Datei; oder
    c) die Dateigröße, die Dateibildgröße, den Typ Subsystem, die Dateicharakteristika aus dem COFF-Header, den Typ Compiler, der verwendet wurde, um die Datei zu erzeugen, und die Frequenzcharakteristika der Zeichen in der Datei.
  7. Verfahren nach Anspruch 1 oder 2, wobei jede Antivirus-Aufzeichnung ferner Informationen umfasst, die das Verfahren zum Berechnen des lokalitätssensitiven Hashes identifizieren, der in der Antivirus-Aufzeichnung enthalten ist.
  8. System zum Erzeugen von Sätzen von Antivirus-Aufzeichnungen, wobei das System umfasst:
    einen Server (120), der einen Hardware-Prozessor (21) aufweist, der dazu konfiguriert ist:
    eine Datenbank (123) von Dateien aufrechtzuerhalten, wobei die Datenbank (123) von Dateien dazu konfiguriert ist, schädliche Dateien, vertrauenswürdige Dateien und nicht vertrauenswürdige Dateien zu speichern;
    mehrere Antivirus-Aufzeichnungen, die unterschiedliche lokalitätssensitive Hashes für jede schädliche Datei enthalten, in der Datenbank (123) von Dateien zu erzeugen, wobei jede der mehreren Antivirus-Aufzeichnungen einen lokalitätssensitiven Hash umfasst, der aus einem unterschiedlichen Satz von Dateiattributen der schädlichen Datei berechnet wurde;
    durch Bestimmen, wie viele unterschiedliche schädliche Dateien unter Verwendung jeder Antivirus-Aufzeichnung detektiert wurden, und einer Anzahl von falschen positiven Detektionen durch die Antivirus-Aufzeichnung eine Effektivität jeder Antivirus-Aufzeichnung zu berechnen;
    einen Satz von effektivsten Antivirus-Aufzeichnungen zu erzeugen, durch:
    Auswählen, für jede bekannte schädliche Datei, der effektivsten Antivirus-Aufzeichnung, die bei einer Detektion der schädlichen Datei verwendet wurde, wobei die effektivste Antivirus-Aufzeichnung als eine Funktion sowohl der Anzahl unterschiedlicher schädlicher Dateien, die durch die Antivirus-Aufzeichnung detektiert wurden, als auch der Anzahl falscher positiver Detektionen durch die Antivirus-Aufzeichnung berechnet wird;
    Bestimmen, ob die ausgewählte Antivirus-Aufzeichnung bereits im Satz enthalten ist; und
    ansprechend auf ein Bestimmen, dass die ausgewählte Antivirus-Aufzeichnung nicht im Satz enthalten ist, Hinzufügen der Aufzeichnung zu dem Satz; und
    den Satz von effektivsten Antivirus-Aufzeichnungen an ein Kundengerät (100) zu übertragen.
  9. System nach Anspruch 8, wobei jede Antivirus-Aufzeichnung ferner eine oder mehrere umfasst von: einer Signatur einer schädlichen Datei; einer heuristischen Regel, die zur Detektion einer schädlichen Datei während einer Emulation der schädlichen Datei verwendet wurde; oder einer heuristischen Regel, die zur Detektion einer schädlichen Datei während einer proaktiven Detektion verwendet wurde.
  10. System nach Anspruch 8 oder 9, wobei das Berechnen einer Effektivität jeder Antivirus-Aufzeichnung ein Sammeln, durch eine Antivirus-Anwendung (121), die auf dem Server (120) läuft, von Statistiken über eine Anzahl von schädlichen Dateien umfasst, die durch die Antivirus-Anwendung (121) unter Verwendung jeder Antivirus-Aufzeichnung detektiert wurden.
  11. System nach Anspruch 8 oder 9, wobei die Effektivität einer Antivirus-Aufzeichnung als eine Funktion einer Anzahl von unterschiedlichen schädlichen Dateien, die durch die Antivirus-Aufzeichnung detektiert wurden, der Anzahl von falschen positiven Detektionen durch die Antivirus-Aufzeichnung und einer Kategorie berechnet wird, zu der jede der detektierten schädlichen Dateien gehört, wobei die Kategorie vertrauenswürdig, nicht vertrauenswürdigen oder schädlich umfasst.
  12. System nach Anspruch 11, wobei die Effektivität einer Antivirus-Aufzeichnung ferner als eine Funktion einer Popularität jeder detektierten schädlichen Datei auf Kundengeräten (100) berechnet wird.
  13. System nach Anspruch 8 oder 9, wobei der Satz von Dateiattributen der schädlichen Datei, der verwendet wird, um wenigstens einen der lokalitätssensitiven Hashes zu berechnen, umfasst:
    a) die Dateigröße, die Dateibildgröße, die Anzahl von Dateisektionen, die zugehörige virtuelle Adresse (Related Virtual Address; RVA) der Dateisektionen, die RVA des Eintrittspunkts, den Typ Subsystem, die Dateicharakteristika aus dem Header des allgemeinen Objektdateiformats (Common-Object-File-Format; COFF), und den Typ Compiler, der verwendet wurde, um die Datei zu erzeugen;
    b) die Dateigröße, die Dateibildgröße, den Typ Subsystem, und die Frequenzcharakteristika der Zeichen in der Datei; oder
    c) die Dateigröße, die Dateibildgröße, den Typ Subsystem, die Dateicharakteristika aus dem COFF-Header, den Typ Compiler, der verwendet wurde, um die Datei zu erzeugen, und die Frequenzcharakteristika der Zeichen in der Datei.
  14. System nach Anspruch 8 oder 9, wobei jede Antivirus-Aufzeichnung ferner Informationen umfasst, die das Verfahren zum Berechnen des lokalitätssensitiven Hashes identifizieren, der in der Antivirus-Aufzeichnung enthalten ist.
  15. Computerprogrammprodukt, das auf einem nichtflüchtigen computerlesbaren Speichermedium gespeichert ist, wobei das Computerprogrammprodukt computerausführbare Instruktionen zum Durchführen der Verfahrensschritte der Ansprüche 1 - 7 umfasst.
EP16158363.8A 2015-09-30 2016-03-03 System und verfahren zur erzeugung von sets von antivirusaufzeichnungen zur detektion von malware auf benutzervorrichtungen Active EP3151148B1 (de)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
RU2015141552A RU2617654C2 (ru) 2015-09-30 2015-09-30 Система и способ формирования набора антивирусных записей, используемых для обнаружения вредоносных файлов на компьютере пользователя
US15/044,435 US9654486B2 (en) 2015-09-30 2016-02-16 System and method for generating sets of antivirus records for detection of malware on user devices

Publications (2)

Publication Number Publication Date
EP3151148A1 EP3151148A1 (de) 2017-04-05
EP3151148B1 true EP3151148B1 (de) 2019-02-20

Family

ID=55456652

Family Applications (1)

Application Number Title Priority Date Filing Date
EP16158363.8A Active EP3151148B1 (de) 2015-09-30 2016-03-03 System und verfahren zur erzeugung von sets von antivirusaufzeichnungen zur detektion von malware auf benutzervorrichtungen

Country Status (1)

Country Link
EP (1) EP3151148B1 (de)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140143869A1 (en) * 2012-11-20 2014-05-22 Symantec Corporation Using telemetry to reduce malware definition package size

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8566943B2 (en) 2009-10-01 2013-10-22 Kaspersky Lab, Zao Asynchronous processing of events for malware detection
US9147073B2 (en) 2013-02-01 2015-09-29 Kaspersky Lab, Zao System and method for automatic generation of heuristic algorithms for malicious object identification
RU2580036C2 (ru) 2013-06-28 2016-04-10 Закрытое акционерное общество "Лаборатория Касперского" Система и способ создания гибкой свертки для обнаружения вредоносных программ
EP2854065B1 (de) * 2013-09-30 2018-06-06 AO Kaspersky Lab System und Verfahren zur Bewertung von Malware-Erkennungsregeln
CN105723378B (zh) * 2013-12-02 2019-06-18 英特尔公司 包括安全规则评估的保护系统

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140143869A1 (en) * 2012-11-20 2014-05-22 Symantec Corporation Using telemetry to reduce malware definition package size

Also Published As

Publication number Publication date
EP3151148A1 (de) 2017-04-05

Similar Documents

Publication Publication Date Title
US9654486B2 (en) System and method for generating sets of antivirus records for detection of malware on user devices
JP6636096B2 (ja) マルウェア検出モデルの機械学習のシステムおよび方法
JP6731988B2 (ja) 訓練された機械学習モデルを使用することで悪意のあるファイルを検出するシステムおよび方法
US10867038B2 (en) System and method of detecting malicious files with the use of elements of static analysis
Chumachenko Machine learning methods for malware detection and classification
EP2955658B1 (de) System und Verfahren zum Nachweis von schädlichen Dateien verschiedener Formate
CN107066883B (zh) 用于阻断脚本执行的系统和方法
RU2739865C2 (ru) Система и способ обнаружения вредоносного файла
US10013555B2 (en) System and method for detecting harmful files executable on a virtual stack machine based on parameters of the files and the virtual stack machine
US10372907B2 (en) System and method of detecting malicious computer systems
CN108369541B (zh) 用于安全威胁的威胁风险评分的系统和方法
US9838420B2 (en) System and method for distributing most effective antivirus records to user devices
EP3151150B1 (de) System und verfahren zur erkennung von phishing-skripten
EP3252645B1 (de) System und verfahren zur erfassung maliziöser computersysteme
EP3151148B1 (de) System und verfahren zur erzeugung von sets von antivirusaufzeichnungen zur detektion von malware auf benutzervorrichtungen
Jawhar A Survey on Malware Attacks Analysis and Detected
RU2774042C1 (ru) Система и способ выявления потенциально вредоносных изменений в приложении
EP3416085B1 (de) System und verfahren zur erkennung von schädlichen dateien mit der anwendung von elementen der statischen analyse
Suresh et al. A Neural Network Based Hybrid Approach for Analysing and Detecting Malware Threat in Android Applications

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20160303

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

RBV Designated contracting states (corrected)

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

17Q First examination report despatched

Effective date: 20180202

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: AO KASPERSKY LAB

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTG Intention to grant announced

Effective date: 20180927

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602016009982

Country of ref document: DE

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 1099162

Country of ref document: AT

Kind code of ref document: T

Effective date: 20190315

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20190220

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190620

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190520

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190521

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190620

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190520

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 1099162

Country of ref document: AT

Kind code of ref document: T

Effective date: 20190220

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602016009982

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20190303

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20190331

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

26N No opposition filed

Effective date: 20191121

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20190331

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20190303

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20190331

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20190331

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20190303

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20160303

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190220

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20240130

Year of fee payment: 9

Ref country code: GB

Payment date: 20240201

Year of fee payment: 9

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20240213

Year of fee payment: 9